Claude Code "don't ask again" leaked secrets in 1,122 files

One click in Claude Code can put your database password on GitHub. Security firm Apiiro searched every public copy of .claude/settings.local.json, the file where Claude Code saves "Yes, and don't ask again" approvals, and found real secrets in 1,122 of them. If your team uses Claude Code and a password ever went into a command it ran, check that file today.

What actually happened

Here is the mechanism, per Apiiro's research. You ask Claude Code to check a database or call an API. The command it proposes carries the secret from your config. You pick "Yes, and don't ask again." Claude Code saves that exact command string as an allow rule, secret included, in the project's .claude/settings.local.json.

Apiiro's numbers, from read-only GitHub searches on November 1–3, 2026:

• 104,185 public copies of the file. 1,122 hold a real secret: 1,379 distinct credentials, including 379 database passwords, 122 Supabase service-role keys, 23 AWS keys and 43 SSH logins.
• 2,539 real secrets in 1,994 repos once you add git history, the shared settings.json, and committed agent transcripts and memory files.
• 63 organizations exposed, including a production Square token at a software agency and the owner password for a medical-records database.
• 215 of the 1,122 files were flagged by neither gitleaks nor TruffleHog. A password after PGPASSWORD= or sshpass -p doesn't look like a key, so scanners skip it.

Claude Code does try to keep this file private. Anthropic's settings docs say it adds the file to your global git excludes the first time it writes it. That rule lives on one laptop. It doesn't travel with the repo, it doesn't cover a folder that becomes a repo later, and it does nothing for a file that's already committed. Apiiro also found that in 539 of 1,105 repos it traced, a commit co-authored by Claude changed the file.

Why it matters for your business

Small teams are the exposed group here. No security team, one shared Supabase project, and a developer who wants the agent to stop asking. That's how a service-role key ends up public.

The fix is cheap. Do it in this order:

1. Search your GitHub org for .claude/settings.local.json and .claude/settings.json, including git history. Forks and clones keep what you delete.
2. Rotate first, clean up second. Any credential that ever sat in that file is burned.
3. Untrack and ignore it with git rm --cached .claude/settings.local.json, then add it to the repo's own .gitignore.
4. Stop typing secrets into commands. Reference $DATABASE_URL from env or a secrets manager, so the saved rule records the variable, not the value.
5. Approve patterns, not literal commands. The permissions docs support rules like Bash(npm run *). Keep them narrow.

Then treat .claude/, .cursor/ and agent memory files like .env: secret-bearing, scanned in CI, never shipped in a Docker image or zip.

Sources: Apiiro: Coding Agents Are Leaking Your Secrets to GitHub, Claude Code settings docs, Claude Code permissions docs.